SeeOnce, URSA released as extensions for Chrome and Firefox

PassLok did it first, and now SeeOnce and URSA have followed. Both are available as extension/addon at the Chrome and Firefox web stores. They are just one click away, and are protected from interference by other code running on the browser. These are the links for SeeOnce: Chrome, Firefox, and for URSA: Chrome, Firefox. And, for good measure, PassLok: Chrome, Firefox, and PassLok for Email: Chrome, Firefox.

SeeOnce has been a (type 2) Chrome app since it started, which was not a particularly happy life since Chrome pretty much hides its apps from the user (they are available only from the Home screen, and often not even there), and imposes on them rather bizarre requirements that have nothing to do with security or performance (such as not being allowed to pop alerts or other code-stopping dialogs). Now that Google has announced that Chrome apps will run only on Chromebooks starting early next year, the move to a different model was unavoidable.

The new “extension” SeeOnce is now live at the Chrome and Firefox web stores. Both for free. Functionality is almost unchanged, except that now chat sessions run inside an iframe and are thereby protected from interference by other extensions or addons running in the browser. Having started this, I decided to give the same treatment to URSA, my symmetric-encryption-only app.

They have become more accessible. Just like the PassLok counterpart, installing the extension or addon puts an icon at the upper right of the browser. Clicking it opens a new tab with the app ready to go. Because the app is loaded with an extension security model, the other extensions that may be loaded in the browser don’t have any access to what happens in the app. You won’t see, for instance, your password manager offering to remember a password for you.

Now, the web-based versions of PassLok, SeeOnce, and URSA can also be isolated from browser extensions by loading them through Page Cage, also available for Chrome and Firefox. Those remain independent from the native extensions, in case you feel super-paranoid, but do not sync their data across machines as the native extensions do.